ST STM32U5 Series User Manual page 6

Step 1: Software build
• The required secure boot firmware and root parameters are linked to the HDP securable memory area,
starting at the address 0x0C00 X000 (see Step 3).
• The parts of the application code not belonging to the secure boot must be linked outside the HDP
securable memory area.
• A detailed building procedure is provided in the Annex, based on the secure boot code example available
in the STM32Cube firmware package defined in
Step 2: Software programming
• Copy the images generated at the previous step into the internal flash memory of the microcontroller.
– The nonplatform required secure boot firmware and root parameters are loaded in the HDP securable
memory at address 0x0C00 X000 (see Step 3).
– All the other parts of the application code not belonging to the secure boot firmware are loaded
outside the HDP securable memory area at the destination address according to the build
parameters.
Step 3: STM32U5x-WBA5x static security protection programming
• Program TZEN=1 (TrustZone
• Set the unique boot entry:
– Program the secure boot memory address modulo 128 bytes: SECBOOTADD0[24:0] = 0x018 X000
(secure flash memory 0x0C00 X000).
◦
– Set BOOT_LOCK=1.
• For the STM32U5 series:
– Program the hidden protection area (HDP) of the platform located in the secure area:
◦
◦
◦
◦
– In FLASH_WRP1AR, program a write-protected memory area (WRP) on the immutable area. This
area must include the HDP area:
◦
◦
◦
• For STM32WBA5 series:
– Program the platform's hide protection area (HDP) located in the secure area:
◦
◦
◦
◦
– In FLASH_WRPAR, program a write-protected memory area (WRP) on the immutable area. This
area must include the HDP area.
◦
◦
◦
• Program read protection in level 2: RDP=0xCC
UM3387 - Rev 1
®
), SWAP_BANK=0 (no swap)
This address must be inside the secure HDP area, with WRP activated. X is defined by the
value written in WRP1A_PSTRT or WRPA_PSTRT (see next).
Program FLASH_SECWM1R1.SECWM1_PSTRT[6:0] = 0 (internal flash memory base
address).
Program FLASH_SECWM1R1.SECWM1_PEND[6:0] = last page of the secure area.
Program FLASH_SECWM1R2.HDP1EN=1.
Program FLASH_SECWM1R2.HDP1_PEND[6:0] = last page including the secure boot
firmware and root parameters programmed in Step 2. It must be lower than SECWM1_PEND.
WRP1A_PSTRT= first page of the WRP area
WRP1A_PEND= the last page of the WRP area. It must be equal to HDP1_PEND
UNLOCK= 0 (locked)
Program FLASH_SECWMR1.SECWM_PSTRT[6:0] = 0 (internal flash memory base address)
Program FLASH_SECWMR1.SECWM_PEND[6:0] = last page of the secure area
Program FLASH_SECWMR2.HDPEN=1
Program FLASH_SECWMR2.HDP_PEND[6:0] = last page including the secure boot firmware
and root parameters programmed in Step 2. It must be lower than SECWM_PEND.
WRPA_PSTRT= first page of the WRP area
WRPA_PEND= the last page of the WRP area. It must be equal to HDP_PEND.
UNLOCK= 0 (locked)
Section 3.2.2.
UM3387
TOE preparative procedures
page 6/22